When someone asks.
WHAT PEOPLE MAY BE ENTITLED TO ASK
What data you hold about them For a copy For correction For deletion To object to certain uses
WHAT VARIES
The specific rights and the time limits depend on the applicable framework.
Take advice on what applies to you.
WHAT TO DO WHEN A REQUEST ARRIVES
Acknowledge it promptly Establish who is asking, and verify it is them Establish what they are asking for Take advice if you are unsure
THE VERIFICATION STEP
Important. Disclosing data to someone impersonating the subject is itself a problem.
WHAT TO SEARCH
Everywhere you hold data, per your audit.
That is why the audit matters.
WHAT TO RECORD
The request, what you did, and when.
WHAT NOT TO DO
Ignore it Respond without verifying identity Delay beyond any applicable period
WHO SHOULD HANDLE IT
Someone specific, who knows to escalate.
WHAT TO PREPARE
A process, before you receive one.
